The repository contains code refered to the work:

Giuseppina Andresini, Annalisa Appice, Nicola Di Mauro, Corrado Loglisci, Donato Malerba

Exploiting the Auto-Encoder Residual Error for Intrusion Detection

The code relies on the following python3.6+ libs.

Packages need are:

• Tensorflow 1.13
• Keras 2.2.4
• Matplotlib 3.0.3
• Pandas 0.24.2
• Numpy 1.15.4
• Scikit-learn

The dataset used for experiments is accessible from NSL-KDD. Original dataset is transformed in a binary classification: "attack, normal" (_oneCls files) and then the feature selection stage is performed by retain the 10top-ranked features according to Information Gain(IG) .

After applying the one-hot encoder mapping to transform the selectedsymbolic features in quantitative ones, an input feature spacewith 89 quantitative features is finally constructed (_Numeric files).

This input features space is expanded with the addition of the residual error feature that is engineered using the auto-encoder trainedon the non-attacking training data. (_mse_Numeric files)

Repository contains scripts of different baseline:

• C1+A1 : script Autoencoder1+ Classification contains code to execute Autoecndoer and Classifcation cascade without error residual feature
• AIDA : script AIDA contains entire step to execute the three AIDA phase:
  • Autoencoder1 model is used for residual-error feature augmentation (Section III-B)
  • Classification model is a neural netowrk with a final softmax layer which use data augmented with residual-error (Section III-D)
  • Autoencoder2 is used for residual-error anomaly-based post-classification (Section III-D)

Code contains models (autoencoder and classification) and datasets used for experiments in the work.

To replicate experiments reported in the work, you can use global variable and models and datasets stored in homonym folders.

    N_CLASSES = 2
    PREPROCESSING1 = 0  #if set to 1 code execute preprocessing phase ( categorical to numeric, one-hot encode, standard scale) on original date
    PREPROCESSING2 = 0  #if set to 1 code execute preprocessing phase ( categorical to numeric, one-hot encode, standard scale) on data augmented
    LOAD_AUTOENCODER1 = 1 #if 1 load autoencoder1 from models folder
    LOAD_CLASSIFIER = 1  #if 1 load classifier  from models folder
    LOAD_MODEL = 1  #if 1 load autoencoder2 from models folder